parliament audits your AWS IAM policies
Project description
parliament is an AWS IAM linting library. It reviews policies looking for problems such as:
- malformed json
- missing required elements
- incorrect prefix and action names
- incorrect resources or conditions for the actions provided
- type mismatches
- bad policy patterns
This library duplicates (and adds to!) much of the functionality in the web console page when reviewing IAM policies in the browser. We wanted that functionality as a library.
The IAM data is obtained from scraping the docs here and parsing this information with beautifulsoup using ./utils/update_iam_data.py.
Installation
pip install parliament
Usage
$ parliament --string '{"Version":"2012-10-17","Statement": {"Effect": "Allow","Action":["s3:GetObject"],"Resource": ["arn:aws:s3:::bucket1"]}}'
INVALID - No resources match for s3:GetObject which requires a resource format of arn:*:s3:::*/* for the resource object* - {'filepath': None}
This example is showing that a resource specifying an S3 bucket (not an object path) was given in a policy with s3:GetObject, which requires an object path.
See ./bin/parliament.py for further examples.
Development
Setup a testing environment
python3 -m venv ./venv && source venv/bin/activate
pip install boto3 jmespath pyyaml nose coverage
Run unit tests with:
./tests/scripts/unit_tests.sh
Run locally as:
bin/parliament
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
File details
Details for the file parliament-0.3.0.tar.gz.
File metadata
- Download URL: parliament-0.3.0.tar.gz
- Upload date:
- Size: 238.2 kB
- Tags: Source
- Uploaded using Trusted Publishing? No
- Uploaded via: twine/3.1.1 pkginfo/1.5.0.1 requests/2.22.0 setuptools/39.0.1 requests-toolbelt/0.9.1 tqdm/4.40.2 CPython/3.7.0
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 | b6cd02159ba02e69797693a828e3fb965e9f9a5a5b4c93232ad206d48f8534c9 |
|
| MD5 | c0482dc13662681decb8e6bb1f6d9ec8 |
|
| BLAKE2b-256 | 7df513a6a6a1c36b36470a39f62f5e987616600895decee672d950692b823471 |
